Although the rapidly growing Internet is convenient, there is great apprehension about its safety, and the need for an advanced cryptographic technique is intensifying to keep the confidentiality of communications. Cryptographic methods commonly used at present are classified into secret key cryptography such as DES (Data Encryption Standard) and Triple DES and public key cryptography such as RSA (Rivest Shamir Adleman) and elliptic curve cryptography. However, these cryptographic methods guarantee the safety based on “complexity of calculations”. Code-breaking using an enormous amount of calculations and new decryption algorithms is an ever present danger.
Under these circumstances, research has been done on quantum cryptosystems which integrate an information transmission system and an encryption system using the principles of quantum mechanics. One of detailed examples is a quantum key distribution (QKD) system which has attracted much attention as an encryption key distribution technique that “never allows eavesdropping”.
The quantum key distribution system generally uses photons as a communication medium and transmits information borne on the quantum state of the photons. An eavesdropper on the transmission path eavesdrops on information by, e.g., tapping photons that are being transmitted. However, once the photons are observed, it is impossible to completely restore their quantum state before observation due to the Heisenberg uncertainty principle. This causes a change in the statistics of received data detected by the authentic recipient. Detecting this change allows the recipient to detect the eavesdropper on the transmission path.
In a quantum key distribution system using the phase of photons, an optical interferometer is formed by a quantum cryptographic transmitter corresponding to a sender (so-called Alice) and a quantum cryptographic receiver corresponding to a recipient (so-called Bob). Each of the quantum cryptographic transmitter and the quantum cryptographic receiver modulates the phase of each photon at random. An output “0” or “1” is obtained depending on the difference in the depth of phase modulation. After that, the quantum cryptographic transmitter and the quantum cryptographic receiver collate some of conditions upon output data measuring. This finally enables the quantum cryptographic transmitter and the quantum cryptographic receiver to share the same bit string.
One of arrangements which are often used as arrangements most suitable for practical use is Japanese Patent Laid-Open No. 2000-517499 (to be referred to as reference 1 hereinafter) or a simpler Plug & Play method described in G. Ribordy, J. D. Gautier, N. Gisin, O. Guinard, and H. Zbindin, “Automated ‘plug & play’ quantum key distribution” (to be referred to as reference 2 hereinafter).
According to the method shown in FIG. 16, in a quantum cryptographic receiver 1303, an optical pulse in a multiphoton state is output from a laser diode 1335 via an optical circulator 1334. The optical pulse is then output to a polarization multiplexer/demultiplexer 1331 via an optical coupler 1333 and temporally divided. Two optical pulses that are orthogonally polarized are transmitted to a quantum cryptographic transmitter 1301 via an optical transmission path 1302.
In the quantum cryptographic transmitter 1301, the optical pulses from the quantum cryptographic receiver 1303 pass through a variable optical attenuator 1314, delay line 1313, and optical phase modulator 1312. A Faraday mirror 1311 reverses the traveling direction of the optical pulses and simultaneously rotates the polarization directions by 90°. The optical phase modulator 1312 applies a phase difference to the divided optical pulses, which then return to the quantum cryptographic receiver 1303 via the delay line 1313 and the variable optical attenuator 1314.
In this loopback structure, the interferometer which temporally divides optical pulses is the same as the interferometer which temporally couples them again. It is therefore possible to implement accurate interference if the interferometer maintains a predetermined optical path difference for only a time longer than the round trip time of optical pulses.
Since a useful single photon source does not yet exist, the quantum key distribution system is implemented in the real world by substitutionally using a method of causing a general laser diode (LD) for communication to generate an optical pulse and an optical attenuator to drop its light intensity to a single photon level. This optical pulse is called a WCP (Weak Coherent Pulse). Hence, the probability of having two or more photons per pulse still remains. This makes for advantage of an eavesdropper. Especially, an eavesdropping method called PNS (Photon Number Splitting) described in B. Huttner et al., “Quantum cryptography with coherent states”, Physical Review A, Vol. 51, No. 3, p. 1863 (to be referred to as reference 3 hereinafter) allows an eavesdropper to perfectly eavesdrop bit information if two or more photons are included per pulse.
On the other hand, a defensive method against the PNS attack has also been proposed. For example, use of a decoy state described in W. Y. Hwang et al., “Quantum Key Distribution with High Loss: Toward Global Secure Communication”, Physical Review Letters, Vol. 91, No. 5, 057901 (to be referred to as reference 4 hereinafter) allows to prevent the PNS attack even when using WCP. This technique generates both a signal state (for example, 0.6 [photons/pulse]) to be used for encryption key generation and a decoy state (for example, 0.1 [photons/pulse]) in which the photon number is changed to obtain photon detection information. The two states are randomly changed for each bit, thereby monitoring a change in the statistics of the number of received photons in case of PNS attack.
Y. Zhao et al., “Experimental Decoy State Quantum Key Distribution Over 15 km”, quant-ph/0503192 (to be referred to as reference 5 hereinafter) has reported quantum key distribution experiments by such a technique using the same experimental system as the quantum key distribution system shown in FIG. 16. In this method, the quantum cryptographic transmitter 1301 causes the Faraday mirror 1311 to reflect an optical pulse from the quantum cryptographic receiver 1303, and the optical phase modulator 1312 to apply phase modulation φA. Then, the pulse is returned to the quantum cryptographic receiver 1303.
The quantum cryptographic receiver 1303 causes the polarization multiplexer/demultiplexer 1331 to demultiplex the optical pulse from the quantum cryptographic transmitter 1301 for a phase modulator 1332 and the optical coupler 1333. The phase modulator 1332 further applies phase modulation φB to the optical pulse. The optical pulse passes through the optical coupler 1333, and a photon detector 1336 detects photons. This makes it possible to share encryption keys “0” and “1” based on the value φA−φB. The average photon number, i.e., light intensity of each pulse is controlled by driving the variable optical attenuator 1314.
In reference 5, the means for controlling the light intensity of each optical pulse is commonly defined as a “variable optical attenuator”. A. Tanaka et al., “Realizing Decoy State on a High-Speed Quantum Cryptosystem”, Proceedings of ECOC2006, We3.P.186 (to be referred to as reference 6 hereinafter) describes an arrangement which enables to simultaneously modulate the phase and intensity of an optical signal by using a dual-drive Mach-Zehnder LN (LiNbO3: lithium niobate) modulator as a photon number control means. Adopting such a modulation method makes it possible to achieve simpler modulation timing design, higher operation speed, and lower system cost.
To quickly modulate light intensity in optical communication, an LN intensity modulator using the light interference effect of a Mach-Zehnder interferometer or an EA (Electro-Absorption) modulator using the field absorption effect of a semiconductor is used in general. The latter EA modulator gives rise to frequency variation (chirping) upon intensity modulation and is therefore inappropriate for quantum key distribution using the phases of photons. For this reason, the most potent light intensity control means is the LN intensity modulator. However, the LN intensity modulator is susceptible to an operating point voltage shift due to DC drift or temperature drift.
The influence of drift and the principle of a common ABC (Auto Bias Control) circuit configured to compensate for drift will be explained below.
In a normal modulation operation, output light as shown in FIG. 17A is obtained. The modulation curve (transfer curve) of the LN intensity modulator is a function curve of cosine square. By supplying a driving signal according to the maximum and minimum points of the curve, an optical signal having the best characteristic, i.e., an optical signal having the highest extinction ratio (On/Off intensity ratio) can be obtained.
If the modulation curve drifts to the negative side (the left side in the drawing) in accordance with the driving signal, the output light changes as shown in FIG. 17B. In this example, it is impossible to completely extinguish the output light even by supplying a voltage “0” at which the light is extinguished best in FIG. 17A. Additionally, even when a voltage “1” at which the light is transmitted best is supplied, the output light is extinguished to some degree and becomes weaker.
On the other hand, if the modulation curve drifts to the positive side (the right side in the drawing) in accordance with the driving signal, the output light changes as shown in FIG. 17C. In this example as well, the extinction ratio of output light degrades. At this time, light intensity of “0” level becomes high, and light intensity of “1” level becomes low. The total intensity of the output light is almost constant independently of the presence/absence of drift. No accurate bias control can be done based on the light intensity information.
For this reason, to quickly modulate light intensity using LN intensity modulation in optical communication, such an operating point voltage shift needs to be compensated to ensure a stable light intensity modulation operation for a long time.
As a conventional bias control technique for a light intensity modulator, Japanese Patent Laid-Open No. 2004-093969 (to be referred to as reference 7 hereinafter) proposes arranging a monitor PD (photodiode) at the output of a Mach-Zehnder interferometer to monitor an optical signal after light intensity modulation and feeding back a pilot signal superimposed on the optical signal to bias control, as shown in FIG. 18A.
As shown in FIGS. 18B and 18C, a pilot signal having a frequency fp [Hz] is superimposed on a modulator driving signal. If the operating point is at a correct position, the “0” level and “1” level of the driving signal correspond to the minimal and maximal points of the modulation curve, respectively. Hence, the output light is turned at the poles and changes its intensity at a rate of 2 fp [Hz]. However, if the operating point is at a wrong position, the 2 fp [Hz] component is not generated in the output light. Using this phenomenon, the 2 fp [Hz] component superimposed on the output light after light intensity modulation is monitored, and bias control is performed to maximize the 2 fp [Hz] component in the output light. This enables to compensate for the drift.
In addition, T. Kataoka et al., “NOVEL AUTOMATIC BIAS VOLTAGE CONTROL FOR TRAVELING-WAVE ELECTRODE OPTICAL MODULATORS”, ELECTRONICS LETTERS, Vol. 27, No. 11, p. 943 (to be referred to as reference 8 hereinafter) proposes a bias control method using the characteristic feature of a traveling-wave electrode. In this method, using the phenomenon that the band of a modulator largely decreases when the propagation direction of light is reverse to that of a modulator driving signal, the bias variation of a modulator is detected based on a variation in the average power of probe light that propagates reversely to the driving signal.